YD/T 4594-2023
Cyberspace security simulation test environment isolation requirements (English Version)

Introduction

Interpretation of the standard framework

Technical dimensions	Isolation requirements	Implementation points
Network isolation	Logical isolation + address isolation	RFC 1918 dedicated address space allocation needs to be implemented
Virtual node isolation	Meet GB/T 35293-2017	Memory/storage access control + fault isolation
Data isolation	Out-of-band management + storage clearing	Physical/logical dual storage control

The standard requires the use of dual mechanisms of address isolation and interconnection isolation:

Each test environment is independently allocated a private address space defined in RFC 1918
Virtual network technology is used to implement broadcast domain isolation (such as VXLAN or NVGRE)
Bandwidth resources need to be hard-isolated through the QoS mechanism

A cloud security laboratory uses the Kubernetes + gVisor solution to implement:

Isolate computing resources through namespaces
Use secure container runtime to protect memory boundaries
Pull the image through the out-of-band network before deployment (reducing bandwidth usage by 30% on average)

Compared with GB/T 31168-2014, this standard adds:

Specific isolation requirements for the test environment (such as 5.2.e prohibiting Internet connection)
Mandatory specifications for out-of-band management (Chapter 6 encryption authentication requirements)
Virtual node fault domain isolation (Clause 7.i)

Regularly verify the effectiveness of the isolation strategy (quarterly penetration testing is recommended)
Establish an image signature verification process
Implement storage media degaussing procedures

GB/T 31168-2014 Information security technology.Security capability requirements of cloud computing services
GB/T 35293-2017 Information technology—Cloud computing—General technical requirements of virtual machine management

2023 YD/T 4594-2023 Cyberspace security simulation test environment isolation requirements